usvg SVGZ decompression bomb in `Tree::from_data`

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-27 04:14 UTC
Importiert: 2026-09-29 06:35 UTC
Quelle-ID: full_disc
uid_hash: 813285023049304b8b15d20d36c85d602e0ebc0a5a59f98af10ad3db29463271

Full Disclosure

Posted by Khashayar Fereidani on Sep 26

Author: Khashayar Fereidani

Disclosure Date: 2026-09-18

Advisory: https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata

Contact: https://fereidani.com/contact

Tree::from_data in crates/usvg/src/parser/mod.rs:102 detects the gzip magic

bytes at the start of the input and decompresses the data before parsing it:


//...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss